What was checked, and why it is not "do they have SSL"

Every website answers on two doors. Port 443 is the https door and serves the site. Port 80 is the http door, and its only job is to hand visitors to 443 and then get out of the way. Both stay open forever, because every old business card, chamber listing and Facebook post from 2019 points at http, and closing that door turns all of them into dead links instead of redirects.

A business can hold a perfectly valid certificate and still show a Not Secure warning to everyone who types their bare domain, because port 80 is serving the site instead of redirecting. That is the most common failure by a wide margin, and it is invisible to the owner. Chrome deliberately stops warning people about sites they visit often, and nobody visits a business's website more often than its owner.

This matters more from October. Chrome 154 turns "Always Use Secure Connections" on by default, and the April 2026 phase already shipped to over a billion people on Enhanced Safe Browsing.

The Front Range numbers

1,168 business domains checked. 979 gave a clear answer, 851 of those passed, 128 failed.

178 domains blocked the check with a 403 or a 429, and 11 point at a booking or social platform rather than a site the business controls. Both are excluded from every number here rather than counted as broken, so this is a floor. A failed check is a failure of the check.

Who to call first

Ranked by how much damage the problem is doing right now, not by how easy it is to fix. A red interstitial costs a business more than a gray label does.

No https at all

Nothing answers on the secure port. From October these are the ones whose first-time visitors meet a permission prompt before the homepage.

Certificate a browser refuses

Expired, self-signed, or issued for a different hostname than the one people type. These produce a full-page red warning, not a small label, and they are the most likely to be losing customers today.

Certificate expiring within three weeks

Valid right now. If renewal is not automatic, each of these moves into the list above on the date shown, usually over a weekend.

Working certificate, and visitors never get sent to it

90 businesses. The secure version exists and works. Anyone who types the bare domain, or follows an old link, stays on the insecure copy for the whole visit and sees Not secure the entire time. Every one of these owners believes they are already done, because they are looking at their own bookmarked https URL.

Boulder restaurants, from tasteboulder.com

Same check against the 576 venues on tasteboulder.com that carry a website link. This one turned up something worse than an https problem: links that are dead on our own live pages today.

Dead links on our live pages

11 venues whose website fails on both http and https. Seven no longer resolve in DNS at all, which usually means the business closed or let the domain go. Each name below links to the dead address, and the second column to the page on our site that still points at it.

Worse than dead

These venues' domains have lapsed and their Google listing now points at an expired-domain marketplace. We are currently sending diners to a domain broker with the restaurant's name on it.

These point at a password-protected page, so no customer can see anything. The site is built and locked, which is a very easy conversation to open.

Restaurants with no working https

The http version serves fine, so the business is trading and the site is up. There is simply no secure version. These are the restaurant equivalent of the first list above, and they are the ones October is aimed at.

Restaurants we can quietly upgrade

12 venues we link over http whose https works perfectly. Nothing wrong with the business, this is our link to fix, not theirs.

Links that miss the front door

Our link lands on a contact form, a gallery, or a locked page instead of the restaurant's homepage. Same problem we just fixed on the med spa site.

Beyond those, 61 restaurant links carry campaign tracking parameters, which hand every click we send to the restaurant's analytics labelled as if it came from Google. 24 could not be judged because the host blocked the check, and those are never counted as failures.

Our own sites

All ten passed on August 2, with certificates 52 to 84 days out and automatic renewal through Cloudflare: annettethompson.com, medspasboulder.com, seobeliever.com, tasteboulder.com, outdoorboulder.com, verityagentic.ai, smartstrongalive.com, curecaninedisease.com, testosteroneinwomen.com and boulderthingstodo.com.

The article this feeds

The SEO Believer draft built on this data is at Your Site Needs Both http:// and https://, 2,776 words, ready to read. The working lead lists with a suggested first message per business are in section 4 of the Boulder lead lists.

The one open decision

The eleven dead restaurant links are a live defect on tasteboulder.com rather than an https question, and there are two honest ways to handle each one: drop the link and leave the venue listed without a website, or go looking for wherever the restaurant moved to first. Several of them have almost certainly closed, in which case the venue should come off the site entirely rather than just losing its link. That is a judgment about the directory, so it is waiting on you.